I refuse to use op cli because of the absolutely bunkers security model that’s a wontfix:

https://news.ycombinator.com/item?id=45478553

https://codeberg.org/manchicken/1password-cli-vuln-disclosur...

Risk of exposing a single credential is nothing compared to the risk of exposing everything through op cli’s expected behavior. Has there been any improvement on this?

▲

binarymax 14 hours ago | parent | next [-]

I read up and that vuln and it’s not the behavior I see. Any read operation to any key in any vault requires auth. Even if the vault is “open” it still asks me every time.

	▲	oefrha 3 hours ago \| parent [-]
		This is false, I just ran my own thorough reproduction script on macOS with latest 1Password app and op cli. Approve a prompt once in a shell session, and all subsequent read attempts of any other secret in that vault from the same shell session (including from subprocesses) don’t result in additional prompts within the time threshold. It’s not at all granular.

▲

chamomeal 17 hours ago | parent | prev [-]

I think I remember a Bitwarden CLI supply chain vulnerability a few months ago?